Homepage
About Snyk

org.apache.flex.blazeds:flex-messaging-core@4.7.0 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.apache.flex.blazeds:flex-messaging-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • C
Arbitrary Code Execution

org.apache.flex.blazeds:flex-messaging-core is a flex messaging core component for blazDS

Affected versions of this package are vulnerable to Arbitrary Code Execution. It uses AMF3 deserializers which allow instantiation of arbitrary classes via public parameter-less constructors. An attacker may exploit this to send a malicious AMF3 object to the system to execute arbitrary code.

How to fix Arbitrary Code Execution?

Upgrade org.apache.flex.blazeds:flex-messaging-core to version 4.7.3 or higher.

[,4.7.3)
  • M
Improper Input Validation

org.apache.flex.blazeds:flex-messaging-core is a flex messaging core component for blazDS

Affected versions of this package are vulnerable to Improper Input Validation. It allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.

How to fix Improper Input Validation?

Upgrade org.apache.flex.blazeds:flex-messaging-core to version 4.7.1 or higher.

[,4.7.1)
  • M
XML External Entity (XXE) Injection

org.apache.flex.blazeds:flex-messaging-core is a flex messaging core component for blazDS

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. A remote attacker could read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference. An AMF message (Action Message Format) is a binary format used to serialize object graphs such as ActionScript objects and XML. The readBody method is used to parse the body of the AMF message,which in turn deserializes the message. Under certain conditions, the body is sent to be parsed in the readXml() method as a UTF string. The xml string is then used to build a Document, via the DocumentBuilder, by using the stringToDocument method. The DocumentBuilder allows external entities by default, resulting in the possible XML External Entity (XXE) injection.

How to fix XML External Entity (XXE) Injection?

Upgrade org.apache.flex.blazeds:flex-messaging-core to version 4.7.1 or higher.

[,4.7.1)
Go back to all versions of this package